Why Are My Emails Going to Spam? SPF, DKIM and DMARC

Your emails are going to spam because the receiving mail server cannot prove they are really from you. That proof comes from three DNS records, SPF, DKIM and DMARC, and most Australian small businesses are missing at least one. In our June 2026 scan of Australian small-business domains, 89% published SPF and 79% had DKIM, but only 43% enforced DMARC^*. Quotes, invoices and replies from those domains start every delivery on the back foot.

The good news: this is a fixable configuration problem, not a verdict on your business. Here is what each record does, what the data says about who is missing what, and the exact order to fix yours.

Key Takeaways

• Emails go to spam mainly because SPF, DKIM and DMARC are missing or misaligned. 57% of Australian small-business domains do not enforce DMARC^*.
• Google and Microsoft both formally require all three records for bulk senders, and weigh them for everyone else.
• Fix order: check what you have with a third-party tool, then SPF, then DKIM, then DMARC at monitor-only, then enforce.

Why do legitimate emails end up in spam?

In 2026, mail providers treat unauthenticated email as guilty until proven innocent. Google's email sender guidelines, in force since February 2024, require SPF, DKIM and DMARC for anyone sending 5,000+ messages a day to Gmail. The same checks run, with real placement consequences, on every smaller sender too (Google, Email sender guidelines, 2024).

Think of it from Gmail's side of the counter. Anyone on the internet can type your domain into an email's From line. Without SPF, DKIM and DMARC, Gmail cannot tell your genuine invoice from a forgery, so it hedges. The hedge is the spam folder.

Content matters less than owners assume. Link shorteners, all-image messages and stale mailing lists do hurt, but in our experience scanning Australian small-business domains, the authentication gap comes first far more often than the content does.

What do SPF, DKIM and DMARC actually do?

Each record answers a different question, and together they close the loop. As of June 2026, 89% of scanned Australian small-business domains publish SPF, 79% sign with DKIM, and 43% enforce DMARC. The further down the chain, the bigger the gap^*.

SPF (Sender Policy Framework) is a public list of the servers allowed to send as your domain. One DNS record. If your mail comes from anywhere else, receivers know something is off.

DKIM (DomainKeys Identified Mail) is a cryptographic signature your mail provider stamps on each message. It proves the message was not altered in transit and really left a server holding your domain's key.

DMARC ties the two together. It tells receivers what to do when a message fails, nothing (p=none), quarantine it, or reject it, and sends you reports on who is sending as your domain. SPF and DKIM without DMARC is a security camera nobody watches.

How does your business compare?

Small businesses trail every other cohort on enforcement, and the gap is wide. Across our five June 2026 Australian cohorts, DMARC enforcement runs from 43% of small-business domains up to 85% of enterprise and government domains (Red Bridge Cyber Posture Research, June 2026).

That gap matters because spam filters grade on the curve the big end of town sets. When most large senders authenticate everything, an unauthenticated domain stands out more, not less.

There is a second cost beyond deliverability. A domain without enforced DMARC can be forged by anyone, and the forgery your customers are most likely to pay is a fake invoice carrying your real domain name. The Australian Cyber Security Centre's small business hub treats email spoofing as one of the basics for exactly that reason.

How to stop your emails going to spam: check, then fix, each record

You do not need to read a single RFC. Here is the sequence we would run on any small-business domain, in order.

1. Check what you have. Run your domain through a third-party checker. MXToolbox's free SuperTool or dmarcian's free domain checker both report SPF, DKIM and DMARC in one pass. (Both are independent tools, not ours; our guide to free website security scanners covers how to read this category of output.) Our paid scan runs the same checks continuously as part of its Email category, in plain English alongside the other four categories, useful once you want the records watched rather than spot-checked.
2. If SPF is missing or broken: ask whoever manages your email (or your provider's setup guide) for the correct SPF record and paste it into your DNS. One record only; two SPF records is itself a failure. Microsoft 365 and Google Workspace each publish theirs, and if a newsletter tool or website form sends as your domain, it needs including too.
3. If DKIM is missing: turn it on in your mail provider's admin console. Both Microsoft 365 and Google Workspace generate the keys for you and tell you exactly which DNS records to add. Signing costs nothing extra; it is just not always on by default.
4. If DMARC is missing: start with monitor-only. A single DNS record (v=DMARC1; p=none; plus a reporting address) changes nothing about delivery but starts showing you who sends as your domain.
5. After a few clean weeks, enforce. Move to p=quarantine, then p=reject, once the reports show only your real senders. This is the step 57% of the small-business domains in our baseline have not taken. It is also the only step that actually stops a forged invoice carrying your domain name.

One honest caution: if your business sends through many systems, accounting software, booking tools, marketing platforms, enforcement needs those reports read first, or you will junk your own mail. That is a reason to do step 4 this week, not a reason to delay it.

And if all three records already pass? Then authentication is not your problem, and the remaining causes are more ordinary: message content that trips filters, a stale list full of dead addresses, or a shared sending platform whose other customers have poisoned the well. Those are worth a separate look, but the authentication gap comes first far more often than not.

Do Google's and Microsoft's sender rules apply to a small business?

Yes. The formal mandates bind bulk senders, but the checks run on everyone. Google's requirements have applied to 5,000+/day senders since February 2024, with Yahoo enforcing matching rules on the same timetable (Google, Email sender guidelines, 2024). In May 2025, Microsoft brought the same SPF-DKIM-DMARC requirement for high-volume senders to Outlook and Hotmail (Microsoft, Outlook high-volume sender requirements, 2025).

Why should a 50-email-a-day business care about a 5,000-email rule? Because the rule documents what the filters already weigh for every message. Small senders are not exempt from the consequences, only from the formal mandate. The records are also identical whatever your volume: the same three DNS entries, set once, checked occasionally.

Frequently asked questions

Will fixing SPF alone get my emails out of spam?

Usually not on its own. SPF, DKIM and DMARC verify different things, and providers weigh them together; Microsoft's May 2025 Outlook requirements name all three explicitly. In our June 2026 baseline, SPF was the record small businesses most often had (89%) and DMARC enforcement the one they most often lacked (43%).

How long until I see a difference?

DNS records take minutes to hours to propagate, and sender reputation moves over days to weeks. As of 2026, Google evaluates authentication on every message, so correct records help immediately. A domain with a poor sending history needs consistent, authenticated sending before placement recovers fully.

Is DMARC at p=none worth publishing at all?

Yes, it is the required first step, not the destination. In our June 2026 baseline, 83% of Australian small-business domains published DMARC but only 43% enforced it. The p=none stage exists to collect reports safely; the protection arrives when you move to quarantine or reject.

Can I do all this without an IT person?

Mostly, yes. Your mail provider's guides cover SPF and DKIM step by step, and third-party tools like MXToolbox verify each change for free. The fiddly part is DMARC report-reading before enforcement. That is the step where it is worth borrowing an hour of expertise if the records and reports are not making sense.

This week's fix, in one paragraph

If your emails are going to spam, run your domain through a third-party checker today, add whichever of SPF and DKIM is missing this week, and publish DMARC at p=none while you are in the DNS console. The whole pass takes under an hour for most Microsoft 365 and Google Workspace setups, and it moves you ahead of most Australian small-business domains in our June 2026 baseline. For the wider context around these records, our plain-English guide to DNS records for small business covers where SPF and DMARC live, and free website security scanners explained covers the third-party tools that check them.

Sources

• Red Bridge Cyber, SMB Posture Baseline, June 2026
• Red Bridge Cyber, Posture Research, five-cohort Australian baseline, June 2026
• Google, Email sender guidelines, https://support.google.com/a/answer/81126
• Microsoft, Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730
• Australian Cyber Security Centre, Small business cyber security hub, https://www.cyber.gov.au/business-government/small-business-cyber-security/small-business-hub